File location on disk
Posted: Fri Mar 13, 2020 3:50 pm
Hi,
Since the search engine for the forum only recognizes keywords and not phrases, I get hundreds of unrelated results when searching for "file location" or "save file names advanced options". So I apologize if this has been answered.
While photorec saves raw files with the filename "fxxxxxxxxxxx" where xxxxxxxxxxx is the disk sector where the file starts, R-Studio just names them in sequential order. How do I find out the file location on the disk? I'm working on NTFS volumes, and if the MFT is intact, I've been able to do it manually from the MFT record number (by finding the record number in the MFT and getting the offset to the data runs).
In the help file, it gives an example of the information saved when using "save file names" that includes MFT number and regions (see below). But I only get a list of file names. The help file also refers to "advanced options" in the "save file names" dialog box that is not there.
While I understand that RAW files won't be linked to the MFT, aside from searching the disk in the hex editor for a unique section of the file data stream, is there any way to report the file location (e.g. number of bytes offset from the start of the volume)?
Structure of a file recovery list file created by R-Studio
An example of such a file:
sort: by real
:# PathDelim = \
Docs\
:! Id: 4587531
:! Flags: directory
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-04-05T22:42:13
:! Accessed: 2011-04-05T22:42:13
:! MFT number: 70
:! Parent MFT number: 5
:! Regions (sector size=512B): sector 2433976 (offset: 50 )
:! size: 2 Bytes / residentsector 2433976 (offset: 80 )
:! size: 72 Bytes / residentsector 2433976 (offset: 176 )
:! size: 74 Bytes / residentsector 2433976 (offset: 288 )
:! size: 222 Bytes / residentsector 2433977
:! size: 136 Bytes / resident
Docs\MyDoc1.odt
:! Id: 4653067
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-03-01T17:41:14
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 71
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2268
:! size: 24 KB (24,576 Bytes) / first datasector 2433978 (offset: 80 )
:! size: 72 Bytes / residentsector 2433978 (offset: 176 )
:! size: 86 Bytes / resident
Docs\MyDoc2.odt
:! Id: 4718603
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-02-28T23:31:02
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 72
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2316
:! size: 24 KB (24,576 Bytes) / first datasector 2433980 (offset: 80 )
:! size: 72 Bytes / residentsector 2433980 (offset: 176 )
:! size: 86 Bytes / resident
Docs\MyDoc3.odt
:! Id: 4784139
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-02-28T23:31:10
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 73
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2020080
:! size: 177.38 MB (185,991,168 Bytes) / first datasector 2433982 (offset: 80 )
:! size: 72 Bytes / residentsector 2433982 (offset: 176 )
:! size: 86 Bytes / resident
Since the search engine for the forum only recognizes keywords and not phrases, I get hundreds of unrelated results when searching for "file location" or "save file names advanced options". So I apologize if this has been answered.
While photorec saves raw files with the filename "fxxxxxxxxxxx" where xxxxxxxxxxx is the disk sector where the file starts, R-Studio just names them in sequential order. How do I find out the file location on the disk? I'm working on NTFS volumes, and if the MFT is intact, I've been able to do it manually from the MFT record number (by finding the record number in the MFT and getting the offset to the data runs).
In the help file, it gives an example of the information saved when using "save file names" that includes MFT number and regions (see below). But I only get a list of file names. The help file also refers to "advanced options" in the "save file names" dialog box that is not there.
While I understand that RAW files won't be linked to the MFT, aside from searching the disk in the hex editor for a unique section of the file data stream, is there any way to report the file location (e.g. number of bytes offset from the start of the volume)?
Structure of a file recovery list file created by R-Studio
An example of such a file:
sort: by real
:# PathDelim = \
Docs\
:! Id: 4587531
:! Flags: directory
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-04-05T22:42:13
:! Accessed: 2011-04-05T22:42:13
:! MFT number: 70
:! Parent MFT number: 5
:! Regions (sector size=512B): sector 2433976 (offset: 50 )
:! size: 2 Bytes / residentsector 2433976 (offset: 80 )
:! size: 72 Bytes / residentsector 2433976 (offset: 176 )
:! size: 74 Bytes / residentsector 2433976 (offset: 288 )
:! size: 222 Bytes / residentsector 2433977
:! size: 136 Bytes / resident
Docs\MyDoc1.odt
:! Id: 4653067
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-03-01T17:41:14
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 71
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2268
:! size: 24 KB (24,576 Bytes) / first datasector 2433978 (offset: 80 )
:! size: 72 Bytes / residentsector 2433978 (offset: 176 )
:! size: 86 Bytes / resident
Docs\MyDoc2.odt
:! Id: 4718603
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-02-28T23:31:02
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 72
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2316
:! size: 24 KB (24,576 Bytes) / first datasector 2433980 (offset: 80 )
:! size: 72 Bytes / residentsector 2433980 (offset: 176 )
:! size: 86 Bytes / resident
Docs\MyDoc3.odt
:! Id: 4784139
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-02-28T23:31:10
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 73
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2020080
:! size: 177.38 MB (185,991,168 Bytes) / first datasector 2433982 (offset: 80 )
:! size: 72 Bytes / residentsector 2433982 (offset: 176 )
:! size: 86 Bytes / resident